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Abstract 

The IRAC Shutter mechanism was originally presented in the paper, “A Low Power Cryogenic Shutter 
Mechanism for Use on Infrared Imagers” at the 34 th Aerospace Mechanisms Symposium, May 2000. At 
that time, the shutter was believed to be performing flawlessly and there was every indication it would 
continue to do so. In early spring of 2001, the calibration shutter, a rotary solenoid designed to be fail-safe 
open, remained in a closed state with no power to the electromagnetic coils. The ensuing investigation, 
subsequent testing, proposed remedy, and lessons learned are the focus of this paper. 

Introduction 


The Infrared Array Camera (IRAC) is one of three instruments on board the Space Infrared Telescope 
Facility (SIRTF), the fourth “Great Observatory”. The SIRTF instruments will provide imagery, photometry, 
and spectroscopy of astronomical bodies of interest over a spectral range of 3.6 to 160 pm. IRAC will take 
images in four bands centered on 3.6, 4.6, 5.8, and 8.0 pm wavelengths 1 . It is a cryogenic instrument 
thermally coupled to a superfluid Flelium dewar with an operational temperature of 1 .4 Kelvin (K). 

Shutter Background and Description 

The IRAC shutter mechanism is required to block incoming 
light energy, producing a dark internal environment, and to 
allow viewing of internal calibration sources for IRAC to 
calibrate its detectors. The two most important requirements 
for the shutter, aside from the level of light attenuation the 
shutter is to provide, are to exhibit low power dissipation to 
limit cryogen depletion, and to be fail-safe open to avoid 
loss of mission in the event of a failure in the closed state. 

These two requirements factored heavily into the shutter 
design and will be addressed further. The mechanism 
(Figure 1) is approximately 0.15 m (5.9 in) long and has a 
mass of 1.25 Kg. It translates a mirrored panel through an 
arc of 0.663 rad (38 deg). The shutter is required to 
attenuate incoming radiation by 1.0E+06. On the inside 
portion of the panel, mirrored surfaces are diamond turned 
to reflect an on-board calibration source through the 
instrument optics onto the focal plane detectors. This 
shutter is required to be fail-safe open, have a lifetime of 
20,000 actuations, operate at 1.4 K, and dissipate less than 
5 mW average power (0.5J/100s). It is required to be 
redundant, and therefore, has two separate actuators, Side 
A and Side B, located on opposite ends of the mechanism, 
driving a common shaft as shown in Figure 2. Separate 
electronic cards drive the Side A and Side B actuators Figure 1. IRAC Shutter Mechanism 
independently. Only one card can be powered at a time and 
only one actuator is required to close the shutter. 

The suspension system of the shutter relies on a torsion flexure to provide axial stiffness, torsional 
preload and restoring torque upon actuation (Figure 3). This flexure is chemically etched from a 0.660- 
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mm (0.026 in) thick sheet of Beryllium Copper (BeCu) 25AT. The flexure is attached to the shaft of the 
shutter at its center point and is fixed at either end by components that fix them in rotation. As the shutter 
closes, a restoring torque is produced in each half of the flexure. The nominal torsional preload in the 
flexure in the open state is approximately 24.7 mN*m (3.5 in»oz). Closed, the flexure produces 49.4 
mN»m (7 in»oz). Bushings at either end of the shaft provide radial stability. They limit radial motion of the 
shaft during vibration and closing operations. Since radial forces approach zero with no current applied to 
the actuators, friction at the bushing interfaces approaches zero as the shutter opens. 


Electromagnetic Coil 



{Side Cross-section) 


The actuators are variable reluctance rotary solenoids designed at GSFC for the IRAC project. All 
magnetic components are made of Hiperco 50A, a soft magnetic material with high magnetic saturation, 
which was heat treated to minimize coercive force. With no permanent magnets in the circuit, the 
actuation of the motor is insensitive to voltage polarity across the coil (i.e. these motors always pull, they 
never push). The design of these motors consists of two stators and a rotor housed within an 
electromagnetic coil. A closeout cylinder then surrounds the coil and joins the two stators at either end 
(Figure 4) thus closing the magnetic circuit. The coil consists of 11500 turns of 38 gage 99.99% pure 

copper wire. Coil resistance drops 
from 2700 Q at room temperature 
to 17 Q at 1.4 K. Low power 
dissipation is achieved by virtue of 
this resistance change and the 
ability to drop the current input 
necessary to hold the shutter 
closed. The lower hold current is a 
product of magnetic tabs that 
extend normal to the stator faces 
(Figure 5). These tabs are 
contacted by the rotor in the 
closed state and complete the 
magnetic circuit in the motor. The 
closed magnetic circuit requires 
dramatically lower current to 
achieve the required flux level and 
resultant torque to maintain a 

closed state against the restoring torque of the torsion flexure. Since power to the coils is l 2 R, lower 
current means less power dissipation. The drive circuitry provides approximately -60 mA to close the 



Figure 3. Shutter suspension system 
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shutter. The current is then reduced to -2.5 mA to maintain the closed position while the instrument runs 
calibration procedures. Current is then removed to allow the shutter to open. 



Figure 4. Exploded view of shutter actuator Figure 5. Shutter rotor and stator 


Description of Failure 

During ground testing at the SIRTF system level, the shutter was found to remain closed with no current 
applied at the conclusion of one of the test sequences, thus violating the fail-open requirement. An 
investigative team was assembled to determine if there were, in fact, a failure, the extent, repeatability, 
and cause of the failure, as well as how to resolve it. 

Events Leading Up To The Failure 

During a review of the IRAC operations, it was discovered that the shutter was operated in an illogical 
manner that, while not damaging hardware, stressed certain electrical components more than necessary. 
The original shutter electronics and software design engineers had long since left NASA, so the design 
philosophy of the command sequence is unclear. The electronics are primarily a closed loop current drive 
with a solid state relay in series with the shutter coil output. When the relay is opened, the feedback 
electronics are zeroed out and held in a low state. When the relay is closed, the system uses feedback 
and a PID controller to track the current level command. The command is a 12-bit word and is scaled 
such that the electronics can output up to +/-80mA in 40pA steps. The original opening sequence in 
V3. 1 3 of the software was: 

- Simultaneously command zero current and open the relay (with 5mA of holding current flowing) 

- 0.2 second later, close the relay 

- 0.1 second later re-open the relay 

This opening and closing of a relay driving current into an inductive load seemed inappropriate. Another 
problem with the original software was that the sensor was not being operated properly. To correct the 
sensor operation and reduce the stress on this relay, the shutter opening command sequence was 
changed in V3.2 to: 

- Command the current to zero (Wait at least 0.1 second) 

- Open the relay 

Soon after the implementation of V3.2, the failure occurred. Therefore, the first suspect was the software. 
However, the investigation showed the software sequence that provided smoother, gentler current 
profiles simply uncovered the low torque margins upon opening that were due to residual magnetism in 
the shutter. 

Investigations on Flight Hardware 

The failure was first diagnosed while processing data taken during the last functional test before breaking 
configuration. The first action was to thoroughly examine all data and telemetry taken during that test. 
There was no evidence of improper commands or current anomalies, so the detailed investigation began. 
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The next step was an attempt to determine the actual state of the shutter. Since the impedance of the 
magnetic circuit changes, resistance, inductance, and capacitance measurements were made on the two 
shutter coils and the sensor coils to determine the state. The shutter was verified to be open. However, 
the shutter coils were inadvertently measured, including changing scales on the resistance meter, before 
those of the sensor. In later investigations, it was determined the current spike produced by changing the 
scale on the multi-meter had the ability to open the shutter if it did remain closed. It was never determined 
whether the shutter opened at the end of the testing, during the move of the dewar, or during the 
impedance measurements, but testing the sensor coil proved to be a valid means to verify position when 
the instrument was powered off. 

A set of tests, run on 6/3/01, instrumented the voltage and current waveforms to verify the functionality of 
the electronics and to capture the differences in behavior using the various software versions. These 
waveforms suggested that the electronics were healthy and appropriately responding to all commands 
sent. They also verified the differences between the command software versions and gave insight to the 
behavior of the shutter under various conditions. During the attempt to capture full opening and closing 
waveforms, it was discovered that using a short pull-in and hold cycle would reproduce the failure 
somewhat consistently. Figure 6 shows the current and voltage profiles of an actuator that fails to open at 
zero current and one that opens properly. This command sequence proved invaluable in further 


Spike 

Opening 


Figure 6. Current and voltage profiles for an actuator that fails to open at zero current 
(left) and one that opens properly (right) 

investigating the anomaly. The first round of tests included capturing the waveforms, sending individual 
commands to prove the closed shutter could be opened by sending current of the opposite polarity, 
measuring the pull-in and release currents on the shutter, and sending various static current levels to 
properly calibrate the current output and telemetry test points for updating the ground data system. Figure 
7 summarizes the release current data for the flight shutter. The results of the tests on 6/3/01 showed that 
the hold currents on Side B were lower than expected, but did not require opposite polarity current to 
open. This was supported by the fact that Side B operations NEVER led to the shutter remaining closed. 
Side A current measurements showed that a slight current in the opposite polarity opened the shutter 
reliably. The results also showed that the pull-in currents were virtually unchanged from previous data. 
This suggested that the spring and shutter coils were healthy. Finally, the calibration tests revealed a +50 
pA Side A offset and a +360 pA Side B offset when zero current was commanded. The current output 
responded linearly to commands and the telemetry feedback equations were updated from a generic 
approximation equation to side-specific equations which fit the data. 

Once these tests were completed, a new and final version of the software was written. The new 
command sequence added a commandable current pulse in the opposite polarity to counteract residual 
magnetism, more time for current commands to settle, and more flexibility in command parameters. The 
Version 3.21 opening sequence is as follows: 

- Turn on the position sensor 




NASA/CP— 2002-21 1 506 


18 




Flight Cold Testing Side A Pull-in and Hold Results 



-40 -20 0 20 40 60 
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- Command zero current then wait 1 second 

- Send a commandable "kick current", +2. 5mA, (Wait a commandable time, 3 seconds) 

- Command zero current then wait 1 second 

- Read the sensor and store the value 

- Open shutter relay and turn off the sensor 
This software version was implemented and the 
electronics were instrumented on 6/14/01. The 
waveforms verified proper operation and the failure 
never repeated. Other tests were run on the flight 
instrument including reverse polarity closings, 
unexpected loss of power, and attempting to use Side B 
to release the shutter after being deliberately stuck 
closed using Side A. The reverse polarity tests showed 
pull-in and hold current comparable to the nominal 
operations. This verified that the magnetic circuit fully 
saturates regardless of polarity when the high, 60mA, 
pull-in current is applied. Side B always released during 
a sudden loss of power, but Side A could be made to 
stay closed under certain conditions. Unfortunately, 

Side B operations were unsuccessful in releasing the 
shutter once Side A was stuck due to residual 
magnetism. This ultimately became the a concern of 
SIRTF management and prompted the study into 
mitigation approaches which could be implemented on 
the flight system. 
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Figure 7. Release current data for the 
IRAC flight shutter 


GSFC Actuator Testing and Analysis 

Considerable effort went into testing the 2 spare units at GSFC to duplicate the failure experienced on the 
flight unit. The impacts of software and electronics board performance were eliminated as root causes of 
the failure through extensive characterization. In order for the mechanism to remain closed with zero 
current the following equation must be satisfied: 

TRestoring Spring — TR eS id ua | Magnetism Tpriction 

Both the magnetic and frictional sources of torque in the mechanism which could cause the mechanism to 
stick with zero current where investigated at length at both room and cryogenic temperatures. The 
actuator components were also tested separately to characterize the release currents and torque 
generated in an actuator without the influence of being in the more complicated shutter assembly. This 
section of the paper will summarize the testing history, magnetic analysis efforts, and some of the key test 
results obtained at GSFC. The results of these efforts confirm that the flight failure is due to intimate 
contact between rotor and stator tab surfaces and the torque generated by residual magnetism. 

History 

Our initial suspicions were that the problem was related to residual magnetism in the rotary solenoid. The 
theoretical possibility that enough residual magnetism could be developed in the actuator to overcome the 
restoring torque of the spring, and thus not allow for failsafe operation, was an aspect of the design and 
was anticipated from the beginning of the design process. The electronics were designed to allow for 
reverse polarity currents to be applied to the actuator to cancel any residual magnetism and the potential 
need for a degauss command was identified. The problem during initial testing prior to delivery to the 
IRAC instrument was that we did not observe a zero current stick condition on any of the 4 units 
developed at GSFC including the flight unit. However, we did see lower than desired hold currents on the 
flight unit during initial assembly and testing. A non-magnetic shim was placed in the magnetic circuit to 
maintain a fixed gap in the circuit in the closed condition. At the time, it was thought that this shim 
provided enough coercive force on the magnetic circuit to effectively reduce the residual magnetism in the 
actuator components after the 60 mA pull-in current was applied. After reassembly with this shim, desired 
release currents were achieved. Unfortunately, after the flight failure occurred, a closer look into the 
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placement of the shim revealed that it was not placed optimally and was subject to potential magnetic 
shorting due to small variations in assembly or shifting of gaps during shutter operation. 


Considerable frustration was endured during initial post failure testing 
which showed very little effect of magnetics on the ability of the 
shutter to remain closed with zero current. Upon examination of the 
rotor and stator parts, a slight burnishing of the rotor where it 
contacted the stator tabs was revealed (Figure 8). Clearly the majority 
of the tab surface was not in intimate contact with the rotor. Only 
when the contacting surfaces of a set of actuators were lapped 
together (Figure 8) did it became apparent that our initial suspicions 
were most likely correct. Approximately 12 pm (0.0005 in) of material 
was removed during the lapping process. When these components 
were assembled into a spare mechanism, the unit consistently failed 
to open with zero current applied. This was a breakthrough in the 
testing program. It showed that small variations in the nature of the 
contact between the rotor and the stator have a significant impact on 
residual magnetism and, therefore, the residual torque that the 
actuator could exhibit. 

Magnetic Analysis and Parameters 

Considerable magnetic analysis was done on the actuator by 
constructing 2-D and 3-D BEM models. Unfortunately, these models 
proved of no use in understanding “small air gap” behavior. It was 
suspected that large flux levels could be developed when the gap Figure 8. Rotor pre and 

between rotor and stator tabs approaches zero. Since laboratory post lapping 

measurements on spare units failed to duplicate flight residual 

magnetic torques necessary to overcome the flexure torque (measurements were less than 14 mN»m (2 
in»oz) compared with the flexure return torque of 50 mN»m (7 in»oz)) and result in a “stuck” condition, the 
question arose as to what the theoretical maximum residual magnetic torque was, and moreover, how 
this behavior was related to air gap distance. Stator/rotor alignment is one factor affecting the minimum 
air gap and tab surface quality is another. 




One analytic solution was utilized which assumed all the material, Carpenter Hiperco 50A, was 
magnetized and that all the reluctance was in the air gap. Another case was run for the case of zero air 
gap wherein the reluctance of the Hiperco was used to determine the maximum magnetic flux, Bmax. 
Hiperco 50A, an alloy of nearly 50/50 iron and cobalt and a few other ingredients, was selected due to its 
ability to carry high flux levels and minimize actuator size and mass. Figures 9 and 10 proved to be 
interesting showing that the B-field at the tabs, and thus the torque generated by the tabs, rises rapidly as 
the air gap reduces below 5 pm (0.0002 in). 


Magnetic Flux Density vs. Air Gap 
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Torque versus Air Gap 
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Figure 9. Analytic solution showing 
relationship of flux with air gap 


Figure 10. Analytic solution showing 
relationship of torque with air gap 
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Laboratory measurements indicated that providing a 2.5 mA reverse current, which allows the “stuck” 
rotor to release, could essentially degauss a lapped unit. Providing too much reverse current resulted in 
re-magnetizing the Hiperco in the reverse direction resulting, again, in a residual magnetic torque. 

Key Test Results 

The following sets of data will be summarized: the ability of residual magnetism to exhibit torques in 
excess of the restoring torque of the spring, the ability to reduce the residual magnetism to a minimum by 
applying a small current of the reverse polarity to the actuator, and the ability to measure the change in 
residual magnetism due to this reverse polarity degauss current by measuring back emf. 

Spare Unit Release Current (Pre Lapping) 

The release current is the value of current at which the shutter opens due to the spring. The torque due to 
friction was found to be negligible due to the design of the shutter mechanism. Measurements of release 
current were made during the assembly process. The desired release current was 1 to 1.5 mA. After the 
failure occurred, it was determined that the assembly process could have a major impact on the release 
current. Machining tolerances were also shown to have a significant effect on residual torques. Better 
alignment and tab contact between the rotor and stator lowers the release current and, therefore, 
decreases the torque margin available to open the shutter. 


Initial testing of the release currents on the spare units 
showed lower but acceptable release current values in 
some cases. None of the spare shutter assemblies or 
actuator components exhibited enough residual magnetism 
to overcome the restoring torque of the spring. However, a 
spare unit was then disassembled and reassembled. It was 
noted that the assembly process could impact the release 
current value. After one particular reassembly process, the 
assembly did fail to open with zero current on rare 
occasions. Figure 1 1 shows release currents for Side A and 
B for the spare unit. It shows the Side A actuator had 
intimate contact and better alignment between the rotor and 
stator than Side B. The more “normal” release currents on 
Side B indicate less tab contact and poorer alignment 
between the rotor and stator in the closed position. 

These measurements were made using a power supply at 
room temperature. Approximately 60 mA was applied to the 
actuator causing the shutter to close. The current was then 
decreased until the shutter opened. The value of the release 
current was then recorded. It is important to note that on the 
rare occasions that a mechanism stuck, it always opened 
when a slight reverse polarity current was applied. These 
reverse polarity currents reduced the residual magnetism 
torque to a level below the restoring torque of the spring 
thus allowing the mechanism to open. Figure 11. Spare shutter release 

current?? 

Actuator torque characteristics and optimal degauss currents (Bounding the Problem) 

After the sensitivity to the nature of the contact between the tab of the rotor to the stator was fully 
appreciated, we decided to improve this contact by lapping. Lapping caused the spare unit to fail to open 
at zero current consistently. However, the mechanism still reliably opened upon application of a slight 
reverse polarity current. We isolated the actuator components in a test set-up to simplify measurement of 
actuator torque. Measurements of torque generated verses applied current were then made and are 
shown in Figure 12. These measurements were performed both pre and post lapping. Prior to lapping of 
the actuator components, intimacy of contact between the rotor and stator was not good enough to 
generate significant residual magnetism torques. After lapping, measurements showed significant 
residual magnetism torques. Values of two to three times the restoring torque of the spring were 
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Non-Lapped Torque vs. Current 


Lapped Torque vs. Current 



Figure 12. Torque vs. current for non-lapped (left) and lapped (right) actuators 

demonstrated. It is believed that the nature of the contact on the flight unit is somewhere in between the 
pre and post lapped cases and that these two cases bound the problem. Therefore, the important concept 
to note is that in the shutter mechanism assembly, the problem is bounded: i.e. higher residual 
magnetism can still be cancelled with slight reverse polarity currents. The magnetic analysis confirmed 
this bounding. There is no condition in which the mechanism can remain closed after sufficient reverse 
polarity current is applied. 


The efficiency of the actuator in the closed position increases as the contact between rotor and stator 
becomes more intimate. Since the gap is smaller with improved contact, a larger percentage of the 
possible residual flux due to saturation (- 1.5 tesla) can be retained. At the same time, since the actuator 
is more efficient, it takes a comparably less Ni of reverse polarity to cancel the residual flux in the 
magnetic circuit. Thus, the problem is bounded. 


Back EMF Measurements and Demonstration of Like Polarity Release Currents 

There still remained the task of devising a test to prove that the failure of the flight mechanism to open 
with zero current was due to residual magnetism and not friction. Friction was eliminated as a plausible 
source of resistive torque through tolerance analysis and observations. Multiple degauss schemes were 
devised to show that the residual magnetism could be affected by reverse polarity currents. In an actuator 
with relatively poor rotor to stator alignment (i.e. a mechanism that does not stick), the effect of reverse 
currents has minimal effect on release currents since the amount of residual flux is small. In addition, 
since a relatively small value of current saturates and re-gausses the tabs, it is difficult to degauss the 
actuator within the constraints of the flight mechanism. In fact, when constrained to access of one coil at a 



Figure 13. Back EMF measurements before (left) and after (right) 
applying a reverse polarity current 
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time as in the flight set-up, it is virtually impossible. However, if both Side A and B are energized at the 
same time it is possible to show that residual magnetism exists in a mechanism. It is also possible to 
show that this residual can be removed by a slight reverse polarity current. Figure 13 shows the voltage 
induced on the shutter coil during opening, or Back EMF, before and after a small reverse polarity 
degauss current is applied. The figure shows that - 85% of the magnetism is removed. In fact tests at 
cryogenic temperature showed that the tabs could easily be degaussed if the shutter was held closed 
during degaussing. However, closing the shutter would re-gauss the tabs and generate the same residual 
magnetism. Unfortunately, due to SIRTF project management concerns over risk and schedule we were 
not able to duplicate these tests on the flight unit. 

Proposed Solutions and Recommendations for the Flight System 

Once the problem had been assessed, we considered several solution remedies to guarantee recovery 
from all plausible failure modes. Opening the dewar and modifying the electronics were both deemed 
unacceptable since the flight hardware was in its final delivered state. This imposed condition limited 
options, but a simple harness modification solution was designed and tested. This "soft cross-strapping" 
concept simply involved adding a resistor between the drive outputs of the Side A and Side B boards 
(Figure 14). This resistor would be significantly larger than the coil resistance, but would allow a small 
transient current to flow in the unused coil. Therefore, if a failure caused a shutdown and the shutter 
remained closed on Side A, simply actuating Side B would provide enough current to Side A to erase the 
residual magnetism. Since the cross-strapped current is a fraction of the primary drive current, it could be 
controlled by command as well. Models were created and tests on an engineering unit were run to 
determine an appropriate range of values for the resistor as well as effects on the un-powered electronics 
board. The soft cross-strap approach successfully closed and opened the engineering unit shutter which 
had been lapped to have maximum residuals on both Side A and Side B. Effects on the un-powered 
board were negligible. Implementing the fix with a combination of series and parallel resistors, this 
solution promised a fault tolerant, robust, and simple fix to the Flight Shutter problem. The only fault that 
could not be corrected was if the Side A coil opened or shorted during a closing cycle using the Side A 
electronics and the residual magnetism was high enough to keep the shutter closed. A thorough study of 
the materials and fabrication techniques of the coil and harnessing indicated this scenario was extremely 
implausible, but not absolutely impossible. However, the final decision of SIRTF management not was to 
run further tests or implement the recommended fix on the Flight Unit. 


CROSS-STRAP R CROSS-STRAP R 



Figure 14. Schematic showing soft cross-strapping 
configuration 
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Lessons Learned 


During the post failure investigation, several notable lessons in the design, fabrication, assembly and 
testing of a space flight mechanism were learned. Errors during each phase of the evolution of a space 
flight mechanism can go undetected. We are fortunate that this characteristic of the IRAC shutter 
mechanism was discovered during ground testing. Problems and solutions that eluded detection during 
each major phase of the IRAC shutter mechanism development will now be discussed. 

Design 

Designing a defined fixed gap into a closed magnetic circuit is a basic concept that should have been 
implemented on the IRAC shutter mechanism rotary actuators. In fact, on a previous mechanism, the 
DIRBE shutter (also designed by GSFC), this was accomplished by gold plating of the contacting 
surfaces of the magnetic circuit. We understood that theoretically the design was sensitive to changes in 
gap in the closed position. However, since testing of engineering units never revealed this sensitivity, this 
possibility was largely ignored. Provisions were taken in the electronics to counteract this problem should 
it occur. However, the implications of discovering this problem later in the program were not fully 
appreciated during the early design phase. 

In addition, material selection could have minimized the potential for this problem to occur. We chose 
Hiperco 50A because of its stable properties from room temperature to 2K and for its high flux saturation 
levels we thought we would need. Hiperco does have a relatively low coercive force when heat treated 
properly. However, other materials, such as pure iron, can exhibit an order of magnitude lower coercive 
force and also have stable properties over our temperature range. 

Fabrication 

Be careful what you ask for; you might get it. During fabrication of developmental units it is sometimes 
tempting to use parts which may have been discrepant or have been made to tolerances that will later be 
tightened for the flight mechanism. In this case, where a design is so sensitive to small variations this 
could be a critical error in thinking. The parameters established by testing of early prototypes often 
become a benchmark for the mechanism developed for flight. Therefore, tightening tolerances to improve 
fit or function may invalidate previous qualification efforts and move the design to an unproven state. 

Assembly 

During the assembly of the flight unit, care was taken to align all of the contact surfaces in both the A and 
B Side actuators. The A Side was aligned first and the B Side was then allowed to conform to the A Side 
alignment. Measurements of release currents were made to ensure the desired value is obtained during 
the assembly process. Release currents on the A Side are typically lower than the B Side. Just prior to 
integration into the IRAC cold assembly, the flight shutter mechanism was disassembled for cleaning. 
Upon reassembly, it underwent a characterization at 4K and was then integrated into the cold assembly. 
Not until after the failure occurred was it appreciated how much of an impact the assembly process could 
have on the release currents and, therefore, the reliability of the mechanism. It is theorized that the final 
assembly of the flight mechanism and subtle shifts during operations and vibrations caused the A Side 
actuator to become marginally “sticky” and detection of its behavior eluded us. Therefore, it is critical to 
understand the impact of the assembly process on the performance of a space flight mechanism. 

Testing 

Even if extensive test data indicates no problem with a mechanism, if flaws exist in the test program or if a 
design error is being masked, there may still be a problem waiting to surface. In this case, continued 
system level characterization of the shutter mechanism was limited due to conflicts with other sub-system 
demands such as software checkout, optical alignment, etc. It is believed that the failure to open with zero 
current on the A side actuator was present but not detected throughout system level testing at GSFC. The 
lesson learned here for a mechanism engineer is not to assume your job is done when a mechanism is 
delivered to the system level. Do not bow to schedule concerns. Make sure that the mechanism is 
functioning properly at the system level. Make sure that the proper check-outs can be implemented at the 
system level. 
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The influence of maintaining a schedule, minimizing costs and accepting some level of risk are always 
present during a project. Many of the lessons learned could have been realized if the development effort 
had not yielded to these pressures. Although it is inevitable that these factors will always influence the 
development process, the mechanism designer must ensure that every aspect of their development 
process is validated by theory, analysis, and test. 

Conclusions 


Disposition of Shutter Failure Investigation 

After the extensive test effort, a SIRTF project peer review was held where the following conclusions and 
recommendation were presented by GSFC to a panel of independent experts: 

• Failure to open at zero current is due to residual magnetism in the shutter mechanism actuator 

• The cause of the residual magnetism is a combination of two factors: 

o An improvement in rotor to stator tab alignment when the shutter was reassembled just prior 
to installation 

o The revised shutter open sequence in software v3.20 augmenting previously unseen 
characteristics 

• The sensitivity of shutter release current to its mechanical alignment was not previously well 
understood and unintended magnetic effects were revealed following the software change from v3.13 
to v3.20. 

• Shutter characterization tests since May 15th have indicated stable performance - no changes in 
performance were observed pre and post CTA vibration testing. 

• Residual magnetic forces are highly sensitive to rotor to stator alignment and gaps 

• Residual magnetism can readily be offset by a small current flow in reverse polarity to the direction of 

actuation 

• The Flight Mechanism has no “defect” and is operating nominally with current understanding of 
mechanism behavior and residual magnetism. 

• It has been shown that Side A shutter can require a slight reverse current to open. Side B has always 
opened at zero current. 

• The shutter can be reliably closed and opened with v3.21 commands. 

• In the event of a failure of the primary drive electronics, a simple resistor “soft cross-strap” can 

provide a reliable secondary current source to open the shutter from the redundant drive electronics. 

• A simple means to provide a small reverse current flow, even in the event of primary electronics 
failure has been developed 

• The case of an open coil winding has been studied and determined to be non-credible 

• Flight shutter Side B has been shown to be completely failsafe in all test and operational scenarios 

Recommendations 

• Continue use of the flight shutter on both Sides A and B where B is the primary side and A is the 
secondary side 

• Implement the Soft Cross-Strap Circuit to provide a backup release means for both actuators 

The independent review panel concurred with all of the conclusions and recommendations that GSFC 
proposed. They agreed with the proposed testing and added that a mini life test be performed to ensure 
the reliability of the mechanism. GSFC was prepared to follow through with the proposed cross-strapping 
modification and necessary testing. Unfortunately, due to programmatic concerns, SIRTF project 
management deemed there would be no further shutter operations and the proposed soft cross strapping 
modification would not be implemented. An operational scheme will be used which will allow calibration of 
the detectors without using the shutter mechanism. 

The IRAC shutter is a prime example of how secondary effects or subtle changes in the design, 
assembly, and testing of a flight mechanism can mask or reveal undesired behavior. As stated above, the 
ultimate conclusion of the investigative team is that the shutter is behaving as one should expect the 
design to behave. It is behaving nominally as built, but not as intended. Its “anomalous” behavior is, in 
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reality, an unfortunate byproduct of improvements in command sequences, tightly toleranced machining, 
precision alignment, and skilled assembly. At first glance, these are all desirable traits for any mechanism. 
However, inconsistencies in any one of these areas during the qualification phase of a development can 
foster a false sense of security and result in surprises during a phase when more rigorous control is 
applied. Fortunately, due to the commitment of a talented group of individuals, a hidden problem for this 
mechanism was found and a potential mission ending failure avoided. 
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